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systems)  focus  primarily  on  alerts.  Some  of  this  difference  is  in 
how  the  systems  are  being  used  and  differences  in  resource  levels. 
However,  it  illustrates  the  need  for  flexibility  in  designing  a 
system  for  multiple  uses. 
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le  case  reporting  application,  and  perform  unit  and  Implementation  of  the  application  is  in  process.  Current  login 
ing  on  both  the  web  application  and  the  central  and  basic  data  display  elements  have  been  completed. 
;  8-11)  Implementation  of  the  first  analytical  components  are  underway. 

A  demonstration  version  of  the  application  has  been  developed, 
and  will  be  used  to  demonstrate  functionality  and  features  to 
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implemented  at  the  participating  counties  and  health  care 
organizations. 


a)  In  concert  with  the  Community  Initiative,  develop  technical  Draft  template  is  in  the  review  and  comment  period, 
agreements  with  the  IT  groups  of  sentinel  sites  healthcare  Estimated  timeline  for  this  task  is  March/ April  2005. 
organizations  with  all  counties,  to  cover  data  elements,  coding, 
security,  and  service-level  agreements.  Develop  similar 
agreements  with  Madigan  for  centralized  exchange  of  ESSENCE 
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Director  participated  in  a  conference  call  with  Col.  Cox  on  2/3/05. 
Col.  Cox  expressed  interest  and  support  for  the  project.  As 
“lessons  learned”  become  available  from  other  similar  projects, 
he  will  provide  that  information  to  the  project. 


Dr.  Peter  Dunbar  met  with  Lieutenant  Colonel  Andrew  Wiesen, 
MD,  PhD,  Clinical  Assistant  Professor,  Madigan  Army  Medical 
Center,  Department  of  Preventive  Medicine  in  November  2004. 
LTC  Wiesen  stated  that  since  Madigan  was  already  reporting  data 
to  ESSENCE  it  would  be  relatively  simple  to  send  data  to 
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expanded  audience  such  as  hospitals,  physicians,  etc.  Further 
refinement  of  Phase  II  elements  will  be  documented  as  part  of  the 
Phase  II  plan  and  scope. 


-  Utility  Assessment/Detection  and  Visualization  Status-  Research  Accomplishments 


undergoing  testing.  The  simulations  are  anticipated  to  start  within 
the  2-4  week  timeframe,  and  will  be  conducted  on  multiple 
computers  at  SKCPH.  An  initial  finding  is  that  for  one  major 
algorithm  the  implementation  that  the  CDC  has  done  of  the 
algorithm  differs  from  the  published  information  on  the 


algorithm.  SKCPH  is  in  communication  with  the  CDC  to  try  and 
resolve  whether  the  published  information  or  the  implemented 
algorithm  is  the  correct  algorithm. 
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Task  5  -  Ethnographic  Analysis  Status-  Research  Accomplishments 
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(American  Medical  Informatics  Association)  annual  meeting  for 
Fall  2005.  The  deadline  for  submission  is  March  15,  2005. 
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Appendix  A 


Puget  Sound  Infectious  Disease  Tracking  System 


Executive  Management  Team  of  Key  Stakeholders  including  Investigators,  Key 
Participants  and  Administrative  Resources: 


Dr.  Peter  Dunbar,  Principal  Investigator,  Puget  Sound  Infectious  Disease  Tracking 
System 

Dr.  Mark  W.  Oberle  Professor  and  Associate  Dean,  School  of  Public  Health, 

University  of  Washington 

Gary  Macy  Executive  Vice  President/CTO,  Paladin  Data  Systems 
Andy  Fallat  CEO,  Foundation  for  Health  Care  Quality 

Dr.  Ian  Painter,  Biostatistician,  Puget  Sound  Infectious  Disease  Tracking  System 

Jerry  Tonkavich  Consultant,  OTB  Solutions  Group  Seattle,  Washington 

Nigel  Turner,  MPH,  RS  Epidemiologist,  Pierce  County 

Michael  C.  Davisson,  State  of  Washington  Department  of  Health 

Linda  Lekness,  MBA,  MSN,  RN,  Executive  Director,  Puget  Sound  Infectious  Disease 
Tracking  System 

Jude  Van  Buren,  Dr.  PH,  MPH,  RN,  RS  Assistant  Secretary,  Epidemiology,  Health 
Statistics  and  Public  Health  Labs,  State  of  Washington  Department  of  Health 

Dr.  Chris  Leininger,  Chief  Information  Officer,  Swedish  Hospital  Seattle,  Washington 

Dr.  Jeff  Duchin  Chief  Epidemiologist,  Seattle/King  County  Health  Department 

Dr.  Scott  Lindquist,  MD,  MPH  Chief  Epidemiologist,  Seattle/King  County  Health 
Department 


Appendix  B 


HIPAA  Compliance  Model  for  PSIDTS 


I.  Objectives 

A.  Principal  Objective:  Identification  of  all  necessary  mechanisms  to  ensure  the  security 
and  privacy  of  proposed  data  collection  is  consistent  with  HIPAA  requirements. 

B.  Secondary  Objective:  Reconciliation  and  incorporation  of  requirements  of  applicable 
state  laws  and  public  health  legal  requirements  with  mechanisms  implemented  for 
HIPAA  compliance  purposes. 

II.  General  Discussion. 

Participants  in  PSIDTS  will  include  a  mix  of  entities  required  to  comply  with  HIPAA,  including 
hospitals,  clinics,  healthcare  payors  and  other  Covered  Entities,  and  entities  which  are  not 
required  to  comply  with  HIPAA.  The  latter  will  principally  include  services  organizations  such 
as  Inland  Northwest  Health  Systems. 

Some  types  of  participants  will  be  "Hybrid  Entities,"  which  perform  both  "covered  functions" 
(i.e.,  act  as  healthcare  providers  and/or  payors)  and  non-covered  functions.  Hybrid  entity 
participants  will  principally  include  state  and  local  public  health  agencies  and  the  Department  of 
Defense. 

HIPAA  creates  potential  obstacles  to  data  sharing  for  PSIDTS  because  of  the  privacy-oriented 
limitations  it  imposes  on  the  use  and  disclosure  of  Protected  Health  Information  ("PHI")  by 
Covered  Entities,  and  the  security  requirements  it  imposes  on  Covered  Entities  for  the  protection 
of  PHI.  PSIDTS  systems  and  operating  policies  will  therefore  have  to  be  structured  to  comply 
with  both  HIPAA's  restrictions  on  PHI  use  and  disclosure,  and  its  security  requirements. 


A.  Application  of  HIPAA  to  PSIDTS  Data. 

As  a  matter  of  prudence  it  should  be  assumed  that  all  data  transmitted  or  stored  for  PSIDTS 
puiposes  which  identifies  or  could  be  used  to  identify  an  individual  is  PHI  subject  to  HIPAA 
protections.  Data  which  does  not  include  or  has  had  all  identifiers  listed  in  the  HIPAA  Privacy 
Rule,  45  CFR  §  164.514(b),  is  not  considered  PHI  and  is  not  subject  to  HIPAA. 


However,  even  data  which  has  been  scrubbed  of  the  listed  identifiers  is  not  considered  de- 
identified  if  the  disclosing  party  actually  knows  the  information  "could  be  used  alone  or  in 
combination  with  other  information  to  identify  an  individual."  This  exception  could  come  into 


play  with  otherwise  de-identified  data  which  concerns  a  rare  condition  and/or  an  incident  likely 
to  be  covered  in  the  media,  or  where  a  large  database  and  sophisticated  data-mining  and  - 
indexing  tools  might  allow  re-identification.  Where  such  a  possibility  is  present,  the  rule  allows 
for  a  demonstration  that  the  data  cannot  be  re-identified  through  expert  statistical  analysis. 

B.  Application  of  HIPAA  to  PSIDTS  Participants. 

Covered  Entities  are  prohibited  from  using  or  disclosing  PHI  except  in  compliance  with  the 
HIPAA  Privacy  Rule,  and  are  required  to  protect  PHI  as  provided  in  the  HIPAA  Security  Rule. 
Hybrid  Entities  are  required  to  treat  their  health  care  components  (which  perform  covered 
functions)  as  if  they  were  Covered  Entities  separate  from  their  other  components. 

The  PPII  use  and  disclosure  limitations  of  the  HIPAA  Privacy  Rule  and  the  PHI  protection 
requirements  of  the  HIPAA  Security  Rule  therefore  control  the  transmission  of  PHI  among 
Covered  Entities  and  from  Covered  Entities  to  non-Covered  Entities,  as  well  as  the  transmission 
and  use  of  PHI  within  Hybrid  Entities. 


C.  Application  of  Washington  Law  to  PSIDTS  Participants. 

HIPAA  does  not  supersede  state  laws  which  are  "more  stringent"  in  their  protection  of  PHI. 
Applicable  Washington  state  laws  include  the  Uniform  Health  Care  Information  Act,  RCW 
70.02  ("HCIA"),  as  well  as  a  common  law  obligation  of  physician  confidentiality.  These  are 
generally  consistent  with  HIPAA,  though  the  HCIA  is  more  stringent  in  some  respects  and 
common  law  requirements  have  not  been  clarified  very  much  by  the  courts. 


III.  Privacy  Discussion 

A.  De-Identified  Data. 

Neither  HIPAA  nor  Washington  state  law  applies  to  de-identified  information  (as  that  term  is 
defined  in  the  HIPAA  Privacy  Rule).  Covered  Entities,  and  the  health  care  components  of 
Hybrid  Entities,  participating  in  PSIDTS  will  therefore  generally  not  be  restricted  in  their 
disclosures  of  de-identified  data  for  Syndromic  Surveillance  purposes. 

However,  as  noted  above  it  is  possible  that  there  may  be  circumstances  where  de-identified  data 
can  be  re-identified,  potentially  present  when  large  quantities  of  data  are  subject  to  sophisticated 
analysis.  It  is  therefore  recommended  that  the  PSIDTS  repository  be  reviewed  and  analyzed  to 
confirm  data  is  not  subject  to  re-identification. 


1.  Recommendation:  Review  potential  for  re-identification  of  data  in 

PSIDTS  repository,  and  if  necessary  perform  statistical  studies  to  demonstrate 
impossibility  of  re-identification,  and/or  implement  policies  and  procedures  preventing 
re-identification. 


B.  Public  Health  Disclosures  through  PSIDTS. 


PSIDTS  disclosures  require  more  analysis  with  respect  to  disclosures  of  PHI.  The  HIPAA 
Privacy  Rule  prohibits  Covered  Entities  from  disclosing  PHI  without  specific,  written 
authorization  except  for  purposes  specifically  authorized  by  the  rule.  Washington's  HCIA 
follows  the  same  approach. 

Both  the  HIPAA  Privacy  Rule,  45  CFR  §  164.5 12(b)(i)  permits  (but  does  not  require)  Covered 
Entities  to  disclose  PHI  for  "public  health  activities  and  purposes,"  but  only  to: 

A  public  health  authority  that  is  authorized  by  law  to  collect  or  receive  such  information 
for  the  purpose  of  preventing  or  controlling  disease,  injury,  or  disability,  including,  but 
not  limited  to,  the  reporting  of  disease,  injury,  vital  events  such  as  birth  or  death,  and  the 
conduct  of  public  health  surveillance,  public  health  investigations,  and  public  health 
interventions!)] 

(Emphasis  added.)  The  regulations  also  more  generally  allow  disclosures  where  "necessary  to 
prevent  or  lessen  a  serious  threat  the  health  or  safety  of  a  person  or  the  public[.]"  45  CFR  § 
164.5120X1). 

Washington  law  takes  a  somewhat  different  approach,  which  appears  to  require  disclosures  of 
protected  information  to  "federal,  state,  or  local  public  health  authorities,"  but  only  "to  the  extent 
the  health  care  provider  is  required  by  law  to  report  health  care  information!)]"  See  RCW 
70.02.050(2)(a).  Washington  law  also  requires  "all  state  or  local  agencies  obtaining  patient 
health  care  information"  under  this  exception  "to  adopt  rules  establishing  their  record  acquisition, 
retention,  and  security  policies"  consistent  with  the  HCIA.  See  RCW  70.02.050(3). 

Washington  law  appears  to  be  "more  stringent"  than  HIPAA,  and  therefore  probably  applies 
though  there  is  no  binding  authority  on  this  point.  In  the  absence  of  binding  legal  authority  most 
Covered  Entities  are  in  any  case  likely  to  assume  the  more  stringent  provisions  apply,  and 
require  that  Washington  law  conditions  be  met. 

Washington  law  does  have  some  requirements  for  public  health  reporting  of  health  care 
information,  but  these  are  not  squarely  on  point  for  PSIDTS.  While  there  are  a  number  of 
proposals  for  state  public  health  laws  which  would  enhance  reporting  requirements,  but  these 
have  not  been  adopted  in  Washington.  The  Washington  law  provision  most  on  point  for  PSIDTS 
appears  to  be  a  Department  of  Health  regulation  requiring  all  health  care  providers  to 


cooperate  with  public  health  authorities  during  investigation  of . . .  circumstances  of  a 
case  or  suspected  case  of  a  notifiable  condition  or  other  communicable  disease  [and]  an 
outbreak  or  suspected  outbreak  of  illness. 


WAC  246-100-021. 


The  HIPAA  and  Washington  state  provisions  can  be  interpreted  together  to  require  (and 
therefore  legally  permit)  health  care  providers  and  the  health  care  provider  components  of 
Hybrid  Entities  to  disclose  PHI  to  public  health  agencies  through  PSIDTS  where  there  is  a 
specific  actual  or  suspected  case,  cases  or  outbreak  under  investigation.  This  interpretation  may 
put  limitations  on  the  subsequent  use  of  PHI  obtained  through  for  surveillance  or  investigation 
purposes  for  research  not  related  to  the  surveillance  or  investigation. 

1 .  Recommendation :  Conduct  further  analysis  of  potential  implications  and  uses  of 
public  health  reporting  exceptions  and  obligations  for  support  of  disclosure  of  PHI 
through  PSIDTS,  and  specify  any  material  limitations  on  or  potential  opportunities 
for  data  gathering,  distribution  and  analysis. 

2.  Recommendation:  Clarify  public  health  authority  of  PSIDTS  data  receivers,  and  if 
necessary  or  desirable  develop  strategies  for  delegating  public  health  authority  to 
appropriate  non-agency  participants. 

3.  Recommendation'.  Develop  an  integrated  interpretation  of  HIPAA  and  Washington 
law  provisions  which  support  participation  in  PSIDTS,  including  any  policies  and 
procedures  necessary  or  prudent  to  assure  compliance  with  HIPAA  and  Washington 
law,  which  is  accepted  as  valid  by  PSIDTS  participants. 

IV.  Security  Discussion. 

HIPAA  and  Washington  law  do  not  appear  to  differ  materially  with  respect  to  security  issues. 
Washington  law  does  require  health  care  providers  to  "effect  reasonable  safeguards  for  the 
security  of  all  health  care  information  [they]  maintain."  RCW  70.02.150.  This  highly  general 
requirement  is  easily  reconciled  with  the  more  detailed  provisions  of  the  HIPAA  Security  Rule. 

Like  the  HIPAA  Privacy  Rule,  the  HIPAA  Security  Rule  applies  only  to  Covered  Entities  and 
the  health  care  components  of  Hybrid  Entities.  Since  PSIDTS  is  not  a  Covered  Entity  -  and  in 
fact  the  PSIDTS  proposal  does  not  currently  contemplate  the  establishment  of  any  entity 
separate  from  the  participants  -  security  compliance  must  therefore  be  accomplished  on  an 
entity-by-entity  basis  by  each  participant. 

However,  the  implementation  of  security  solutions  within  organizational  "silos"  creates  the 
potential  for  interoperational  failures.  For  example,  data  sent  by  one  participant  may  be  rejected 
by  another  participant  for  failure  to  meet  the  latter  participant's  authentication  requirements.  Or, 
negligent  perimeter  control  by  one  participant  might  permit  a  hostile  outsider  to  "spoof'  a 
participant's  identity  and  communicate  false  data  or  otherwise  interfere  with  PSIDTS  operations 
and  data  quality. 


PSIDTS  therefore  requires  operational  consistency,  including  but  not  limited  to  consistent 
solutions  for  identification  and  authentication  of  individuals  and  entities  using  the  system,  access 
controls,  and  other  policies,  procedures  and  technical  solutions  which  are  also  reasonable  and 
appropriate  for  the  participants'  use  under  the  HIPAA  Security  Rule. 

PSIDTS  currently  lacks  a  governing  body  which  can  solve  these  problems,  and  the  solutions 
ought  to  be  developed  will  need  to  meet  the  needs  of  and  be  accepted  by  the  participants  in  any 
case.  Specific  security  solutions  and  requirements  for  PSIDTS  should  therefore  be  developed 


through  a  process  which  identifies  and  develops  consensus  solutions  to  security  issues  affecting 
PSIDTS  participation. 

1.  Recommendation:  Steering  Committee  to  oversee  the  ongoing  develop  of 

policies,  procedures  and  technical  solutions  applicable  to  PSIDTS  systems  which  are 
consistent  with  participants'  internal  HIPAA  security  compliance  programs. 


Appendix  C 


. Original  Message . 

From:  Andrew  Fallat  [mailto:afallat@qualityhealth.org] 

Sent:  Tuesday,  December  23,  2003  2:34  PM 

To:  'Ward,  Sherry  L  Dr  USAMRMC 

Cc:  ’Peter  Dunbar  (E-mail)';  'Todd  Langton  (E-mail)' 

Subject:  PR033147  -  Puget  Sound  Infectious  Disease  Tacking  System  (PSIDTS) 

The  purpose  of  this  email  is  to  follow-up  on  our  telephone  conversation  on  Monday,  December  22,  2003. 
We  appreciate  your  observations  and  believe  we  have  addressed  each  topic.  I  am  concerned  that  the 
memo  is  longer  than  anticipated  but  I  concluded  that  it  was  better  to  provide  a  more  thorough  record  for 
your  review. 

Does  PSIDTS  still  have  value  to  DoD? 

PSIDTS  has  immediate  and  time  sensitive  value  to  Department  of  Defense  (DoD)  personnel.  We  are 
concerned  that  benefit  may  be  compromised  if  the  Proposal  is  delayed  and  opportunity  to  work  with  DoD 
ESSENCE  leadership  at  Madigan  Army  Medical  Center  is  lost  during  DoD's  JSIPP  implementation.  We 
believe  that  the  (unfunded)  work  we  have  accomplished  since  receiving  Patricia  Evans, 
Contracting/Grants  Officer's  9/10/03  Recommendation  for  Funding  letter  has  significantly  improved  the 
Proposal's  value  to  the  military. 

The  Military  Relevance  Statement  provided  with  the  Proposal  remains  sound,  without  any  reservation 
whatsoever.  PSIDTS  will  develop  and  evaluate  different  techniques  to  acquire  data  on  civilian  health 
populations.  In  collaboration  with  cross-jurisdictional  public  health  leaders,  this  data  provides  the  first 
Immediate  Benefit:  a  regional  sentinel  system.  The  Long  Term  benefits  remain  the  same,  with  the 
exception  of  researching  additional  means  of  integrating  with  ESSENCE  rather  than  a  web-based  system. 
This  improvement  addresses  a  weakness  identified  and  articulated  by  DoD  Programmatic  Reviewers  in 
their  critique  (see  next  section). 

The  9/10/03  Funding  letter  recommended  that  a  partnership  with  researchers  at  the  Department  of 
Defense  Global  Emerging  Infections  System  http://www.geis.ha.osd.mil/.  We  have  accomplished  this 
partnership  and  have  secured  GEIS  participation  on  PSIDTS  Steering  Committee,  through  LTC  Julie 
Pavlin,  Head,  Electronic  Surveillance  System  for  the  Early  Notification  of  Community-Based  Epidemics 
(ESSENCE)  http://www.geis.ha.osd.mil/GEIS/SurveillanceActivities/ESSENCE/ESSENCE.asp. 

Through  collaboration  with  Madigan  Army  Medical  Center  and  ESSENCE  we  learned  that  Fort  Lewis  (the 
home  base  for  Madigan  Army  Medical  Center)  was  selected  as  a  JSIPP  site.  PSIDTS  is  committed  to 
partnership  and  value  to  DoD:  therefore  it  appeared  to  increase  PSIDTS's  value  to  DoD  to  work  within  the 
priorities  and  interests  of  DoD  as  established  for  Fort  Lewis. 

http://www.geis.ha.osd.mil/GEIS/SurveillanceActivities/ESSENCE/JSIPPexsum.asp. 

Our  partnership  with  GEIS,  ESSENCE  and  Madigan  has  increased  value  to  DoD.  On  the  other  hand,  if 
we  fail  to  move  ahead  and  secure  the  immediate  benefits  of  a  regional  sentinel  system  in  the  strategically 
valuable  Pacific  Northwest  (using  the  collaborative  interests  of  DoD's  other  major  initiative  ESSENCE)  we 
may  lose  a  time  sensitive  opportunity. 


Does  the  absence  of  a  letter  confirming  access  to  data  on  military  subjects  merit  a  delay? 

The  absence  of  a  letter  confirming  access  to  data  on  military  subjects  is  not  unusual  at  this  stage  in  the 
Proposal.  In  fact,  it  was  anticipated  that  Tasks  1  and  3  would  articulate  the  privacy/security  issues  prior 
to  securing  access.  It  may  be  ironic  that  a  Proposal  designed  to  research  practices/policies  to  improve 
partnership  between  civilian/DoD  may  be  delayed  because  it  could  not  secure,  in  advance,  an  objective 
that  was  scheduled  for  its  end. 


Unlike  research  utilizing  the  clinical  details  of  specific  DoD  personnel  (and  therefore  clearly  described  in  a 
proposal  and  dependent  on  access  to  clinical  data  on  military  subjects),  PSIDTS  relies  on  access  to 
civilian  data  which  creates  a  regional,  sentinel  system  available  to  DoD.  This  civilian  information  is  valued 
by  DoD,  will  be  integrated  into  ESSENCE  and  used  by  DoD  to  expand  its  knowledge  of  Community- 
based  Infections  affecting  DoD  personnel.  It  is  the  intent  and  on-going  practice  of  DoD/ESSENCE  to 
share  data  with  civilian  authorities;  however,  before  a  specific  confirmation  of  access  can  be  solicited, 
Proposal's  Task  1  needs  to  begin. 

Access  to  data  on  military  subjects  is  being  addressed  in  accordance  with  the  original  Statement  of  Work. 
DoD  leadership  accepts  responsibility  for  releasing  access  to  data  and  will  do  so  only  when  the  utility  to 
DoD  is  addressed  and  security  in  place  to  assure  mandated  confidentiality.  Indeed,  this  work  was 
anticipated  in  Proposal's  Tasks  1c,  Id,  3a,  3c,  3d  and  3e  (all  related  to  developing  standards  and  policies 
related  to  data  access). 

It  was  also  recognized  that  PSIDTS  may  be  in  partnership  with  either  Madigan  or  GEIS,  or  both.  (Tasks 
3a,  3d)  We  secured  a  Letter  of  Collaboration  with  Madigan  indicating  that  more  specific  requests  would 
go  to  their  IRB  if  and  when  that  request  was  essential.  We  consulted  with  LTC  Julie  Pavlin  who 
described  the  ESSENCE  approach  to  access  to  data  on  military  subjects  (see  attached  Word  document 
entitled  "Memo  for  Sharing),  in  which  citations  are  provided  indicating  that  it  is  both  authorized  and 
previous  practice  for  DoD  to  share  surveillance  data  with  civilian  authorities. 

f5 

Memo  for  sharing 
TMA  data.doc 

We  conclude  that  a  major  accomplishment  of  this  Proposal  will  be  to  assist  civilian  communities  and  DoD 
learn  methods  and  policies  essential  to  timely  and  appropriate  sharing  of  surveillance  information.  We 
believe  that  DoD's  ESSENCE  project  is  leading  the  way  and  we  intend  to  work  with  ESSENCE  through 
Task  1  to  bring  in  other  military  approvals  as  necessary. 

We  conclude  it  is  futile  (and  perhaps  a  detriment  to  developing  future  infectious  surveillance  partnerships 
with  DoD)  to  attempt  to  secure  detailed  letters  of  assurance  without  first  accomplishing  the  work 
described  and  funded  in  Task  1. 


Should  the  Statement  of  Work  be  amended  and  resubmitted? 

The  Statement  of  Work  remains  an  accurate  description  of  our  Proposal.  We  will  broaden  input  methods 
into  the  Surveillance  system,  in  recognition  of  comments  made  by  Programmatic  Reviewers  and  other 
DoD  leaders  in  ESSENCE. 

The  Statement  of  Work  describes  five  major  Tasks,  with  16  sub-tasks.  Task  2  identifies  developing  a 
web-based  case  reporting  system.  The  four  Task  2  sub-tasks  are  generic  to  case  reporting  and  not 
dependent  on  web-based  reporting.  Collaboration  with  DoD  personnel  within  ESSENCE  indicates  that 
other  input  systems  are  preferred.  These  comments  are  consistent  with  weaknesses  identified  in  the 
Programmatic  Reviewer's  comments  (p.7):  "The  proposal  may  overestimate  the  workability  of  the  Web- 
based  tool  for  providers  to  use".  And  again:  "One  concern  relates  to.. .the  time  required  to  input  data  into 
the  automated  data  collection  system".  The  four  sub-tasks  under  Task  2  remain  relevant  except  that  they 
will  be  applied  to  other  collection  methods  consistent  with  ESSENCE.  Stated  differently,  all  16  of  the  sub¬ 
tasks  are  relevant  and  will  be  performed. 

We  also  believe  that  bi-directional  exchange  of  information  will  occur  with  DoD,  in  accordance  with  the 
stated  goal  of  ESSENCE  and  the  established  practice  of  DoD  related  to  Infectious  Surveillance.  We  see 
no  change  to  Statement  of  Work  in  that  arena. 

I  have  neither  expertise  nor  experience  on  which  to  base  a  conclusion  regarding  the  necessity  of  an 
amendment.  It  seems  to  be  administratively  complex,  however,  to  resubmit  a  new  Statement  of  Work 


because  of  a  heading  change  when  all  the  sub-tasks  remain  the  same.  We  believe  the  input  process  was 
improved  by  replacing  a  technique  that  was  described  as  a  "weakness"  by  Programmatic  Reviewers  with 
another  process  preferred  by  DoD  partners  we  were  encouraged  by  DoD  to  invite  to  the  Proposal. 


Is  "cost-reimbursed"  grant  acceptable  to  the  Foundation? 

Yes,  a  cost-reimbursement  grant  award  is  acceptable  to  the  Foundation.  The  Foundation  does  not  have 
working  capital  sufficient  to  make  other  than  nominal  advances  to  staff  and  vendors.  Likewise,  the 
Foundation  cannot  risk  incurring  expenses  without  assurance  that  they  will  be  reimbursed.  As  long  as 
"cost-reimbursed"  permits  both  a  reasonable  amount  of  working  capital  and  staffing  adequate  to  handle 
Foundation  requests  (with  quick  turn  around)  for  assurance  about  specific  potential  expenses,  then  "cost- 
reimbursed"  is  acceptable. 


Thank  you  for  the  opportunity  to  respond  to  your  observations.  We  appreciate  your  consideration  of 
funding  decisions  essential  to  our  beginning  work  on  PSIDTS.  We  anticipate  your  call  to  Todd  Langton 
on  December  30. 

Andrew  Fallat 
President/CEO 

Foundation  for  Health  Care  Quality 
Seattle,  WA 


